WIP: add argument for custom pre-request handler

src/PostgREST/Config.hs

@@ -43,6 +43,7 @@ data AppConfig = AppConfig {
   , configJwtSecret :: Maybe Text
   , configPool      :: Int
   , configMaxRows   :: Maybe Integer
+  , configReqCheck  :: Maybe Text
   , configQuiet     :: Bool
   }
 
@@ -57,6 +58,7 @@ argParser = AppConfig
   <*> (optional . map toS <$> strOption) (long "jwt-secret" <> short 'j' <> help "secret used to encrypt and decrypt JWT tokens" <> metavar "SECRET")
   <*> option auto  (long "pool"       <> short 'o' <> help "max connections in database pool" <> metavar "COUNT" <> value 10 <> showDefault)
   <*> (readMay <$> strOption  (long "max-rows"   <> short 'm' <> help "max rows in response" <> metavar "COUNT" <> value "infinity" <> showDefault))
+  <*> (optional . map toS . strOption) (long "pre-request"  <> help "schema-qualified name of proc to call to validate requests" <> metavar "FUNCTION")
   <*> pure False
 
 defaultCorsPolicy :: CorsResourcePolicy

src/PostgREST/Middleware.hs

@@ -32,10 +32,13 @@ runWithClaims conf eClaims app req =
     JWTMissingSecret -> return $ errResponse status500 "Server lacks JWT secret"
     JWTClaims claims -> do
       -- role claim defaults to anon if not specified in jwt
-      H.sql . mconcat . claimsToSQL $ M.union claims (M.singleton "role" anon)
+      let setClaims = claimsToSQL (M.union claims (M.singleton "role" anon))
+      H.sql (mconcat $ setClaims ++ customReqCheck)
       app req
   where
     anon = String . toS $ configAnonRole conf
+    customReqCheck = maybeToList $ (\f -> "select " <> toS f <> "();")
+                                 <$> configReqCheck conf
     unauthed message = responseLBS unauthorized401
       [ ctToHeader CTApplicationJSON
       , ( "WWW-Authenticate"